From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Tue, 16 Jun 2026 08:49:50 +0000 (+0200)
Subject: - Fix incorrect cleanup after an allocation failure for
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aabf28aef52ccf8a01fce0f455c03e51c978f6e6;p=thirdparty%2Funbound.git

- Fix incorrect cleanup after an allocation failure for
  a delegation point. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
---

diff --git a/doc/Changelog b/doc/Changelog
index e9894a09d..2672f3319 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -44,6 +44,9 @@
 	- Fix for neater solution to clear log thread id after
 	  worker init failure. Thanks to Qifan Zhang, Palo Alto
 	  Networks, for the report.
+	- Fix incorrect cleanup after an allocation failure for
+	  a delegation point. Thanks to Qifan Zhang, Palo Alto
+	  Networks, for the report.
 
 15 June 2026: Wouter
 	- Fix to add `max-transfer-size` and `max-transfer-time` that
diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c
index 5b609c960..7f3bef943 100644
--- a/iterator/iter_delegpt.c
+++ b/iterator/iter_delegpt.c
@@ -664,8 +664,6 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
 		free(ns);
 		return 0;
 	}
-	ns->next = dp->nslist;
-	dp->nslist = ns;
 	ns->cache_lookup_count = 0;
 	ns->resolved = 0;
 	ns->got4 = 0;
@@ -684,6 +682,8 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
 	} else {
 		ns->tls_auth_name = NULL;
 	}
+	ns->next = dp->nslist;
+	dp->nslist = ns;
 	return 1;
 }
 
@@ -709,11 +709,7 @@ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
 	a = (struct delegpt_addr*)malloc(sizeof(struct delegpt_addr));
 	if(!a)
 		return 0;
-	a->next_target = dp->target_list;
-	dp->target_list = a;
 	a->next_result = 0;
-	a->next_usable = dp->usable_list;
-	dp->usable_list = a;
 	memcpy(&a->addr, addr, addrlen);
 	a->addrlen = addrlen;
 	a->attempts = 0;
@@ -729,6 +725,10 @@ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
 	} else {
 		a->tls_auth_name = NULL;
 	}
+	a->next_target = dp->target_list;
+	dp->target_list = a;
+	a->next_usable = dp->usable_list;
+	dp->usable_list = a;
 	return 1;
 }